EUVD-2026-43943
GHSA-r464-pwqp-f636
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP requiring an existing low-privileged session (AV:L, PR:L), reliably triggerable with no user interaction (AC:L, UI:N), yielding full SYSTEM-level C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows User Interface Core (UI Core) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a relative path traversal flaw lets an already-authenticated low-privileged user escalate to higher privileges on the local machine. The CVSS 3.1 score of 7.8 reflects full confidentiality, integrity, and availability impact once triggered, though attack requires local access and existing low-level privileges. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the Windows User Interface Core component, a system-level subsystem of the Windows shell/UI stack present across current Windows 11 client builds and Windows Server 2025. The root cause is CWE-23 (Relative Path Traversal): the component resolves a file or resource path using attacker-influenced relative sequences (e.g., '..\') without properly canonicalizing or constraining the path to an intended directory. Because the affected code executes with elevated privilege in the Windows session, a low-privileged process that controls part of a path can direct file operations outside the intended boundary, enabling privileged write/read or code execution in a higher-integrity context. The CPE data confirms the affected products are Windows 11 Version 24H2, 25H2, 26H1, Windows Server 2025 and its Server Core installation.
RemediationAI
Apply the Microsoft security update for CVE-2026-50454 as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50454 (Patch available per vendor advisory); deploy it to all Windows 11 24H2/25H2/26H1 and Windows Server 2025 systems, including Server Core installations, via Windows Update, WSUS, or your patch-management tooling. The exact fixed KB/build number was not provided in the input, so retrieve it from the MSRC page for your specific OS build before deployment. Because exploitation requires an existing authenticated local foothold, interim compensating controls focus on limiting who can run code locally: enforce least privilege so untrusted or standard users cannot obtain interactive local sessions on servers, apply application allowlisting (WDAC/AppLocker) to block untrusted binaries, and monitor for anomalous file operations traversing directories by privileged UI components - noting these controls reduce but do not eliminate risk and are no substitute for the patch.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
MSHTML Framework contains a protection mechanism failure (CVE-2026-21513, CVSS 8.8) allowing remote attackers to bypass
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today